Hi Matej, On Sat, Sep 12, 2026 at 03:27:17PM +0200, Matej Smycka wrote: > elf_from_remote_memory allocates a buffer of contents_size and then > writes the ELF header into it. When the last PT_LOAD has p_filesz 0 > (and p_memsz nonzero) contents_size collapses to zero and the 52/64 > byte header is written past the allocation. Reject the image before > allocating when contents_size is smaller than the header.
This looks correct. > This > completes commit 2ee961ba, which bounded the segment copies; the header > write is the remaining out-of-bounds path. Hope we got them all now. > * libdwfl/elf-from-memory.c (elf_from_remote_memory): Goto bad_elf > when contents_size is smaller than the Ehdr. > > Signed-off-by: Matej Smycka <[email protected]> > --- > libdwfl/elf-from-memory.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/libdwfl/elf-from-memory.c b/libdwfl/elf-from-memory.c > index 775d5a1f..4015efd2 100644 > --- a/libdwfl/elf-from-memory.c > +++ b/libdwfl/elf-from-memory.c > @@ -282,6 +282,11 @@ elf_from_remote_memory (GElf_Addr ehdr_vma, > else > contents_size = segments_end; > > + /* Make sure the image is big enough for the ELF header written out > + below; otherwise the elfNN_xlatetof of the header overflows it. */ > + if (contents_size < (class32 ? sizeof ehdr.e32 : sizeof ehdr.e64)) > + goto bad_elf; > + > free (buffer); the goto bad_elf does a free (buffer) so this doesn't leak. Pushed as https://sourceware.org/cgit/elfutils/commit/?id=7961c9813a9e Thanks, Mark
